UbuntuUpdates.org

Package "nginx-light"

Name: nginx-light

Description:

nginx web/proxy server (basic version)
Latest version: 1.30.4-7ubuntu1.1
Release: stonking (26.10)
Level: security
Repository: universe
Head package: nginx
Homepage: https://nginx.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx-light"

All arch deb package
APT INSTALL

Other versions of "nginx-light" in Stonking

Repository Area Version
base universe 1.30.4-7ubuntu1
updates universe 1.30.4-7ubuntu1.1

Changelog

Version: 1.30.4-7ubuntu1.1 2026-10-26 18:07:46 UTC

nginx (1.30.4-7ubuntu1.1) stonking-security; urgency=medium

  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-15176.patch: Avoid post-rewrite URI to path
      mapping with alias in src/http/ngx_http_core_module.c.
    - CVE-2026-15176
  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-93479.patch: Script: reserved memory overrun
      protection in ngx_http_script_run() in src/http/ngx_http_script.c,
      src/stream/ngx_stream_script.c.
    - CVE-2026-93479
  * SECURITY UPDATE: data injection via HTTP/3 with proxy_request_buffering
    - debian/patches/CVE-2026-95101.patch: HTTP/3: kept the skipped frame length
      separate from data length in src/http/v3/ngx_http_v3_parse.c.
    - CVE-2026-95101
  * SECURITY UPDATE: UaF when asynchronous file I/O is enabled
    - debian/patches/CVE-2026-97205.patch: Limited the number of pending
      operations per request in src/http/ngx_http_copy_filter_module.c,
      src/http/ngx_http_file_cache.c, src/http/ngx_http_upstream.c.
    - CVE-2026-97205
  * SECURITY UPDATE: client SSL session forgery
    - debian/patches/CVE-2026-97629.patch: SSL: synced all session ticket keys
      to the worker process in src/event/ngx_event_openssl.c.
    - CVE-2026-97629

 -- Marc Deslauriers Sat, 24 Oct 2026 10:17:32 -0400
CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a se
CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format refer
CVE-2026-95101 Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering
CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain conf
CVE-2026-97629 Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key


About   -   Send Feedback to @ubuntu_updates